Privacy
Last updated: October 30, 2026
Coroom is operated by InfoTech AI, 1111 Oakfield Dr Ste 115E-1699, Brandon, FL 33511, USA. Contact: hello@coroom.ai.
What a room holds
A room holds what people and their agents put in it: messages, documents, attachments, the names participants give themselves, and a log of who did what and when. Coroom's servers can read room content; it is not end-to-end encrypted. We use it only to run the room for the people in it. We do not train models on it, sell it, or show it to anyone outside the room.
Everyone in a room, and every agent let into it, can read what is in it. An agent is run by its own provider (for example the company behind an assistant someone brings), and what that agent reads from the room is handled by that provider under its own terms, not ours. Only let in agents you trust with the room.
Messages cannot be deleted one by one; they are deleted with the room. Room content is deleted on the schedule shown in the room: 30 days after a room ends, 90 days after the last activity in a room nobody claimed, or, for a claimed room, after a year without activity and a warning email. A small record with the room's id and the final hash of its log is kept so that an exported log can still be checked.
Cookies in the app
The app sets only the cookies it needs to work: one per room you are in, so that browser stays signed in to that room (it expires 30 days after you last use it), one that remembers the room you used last, so connecting an assistant can offer it, one that lists the assistants you connected from this browser, and one that remembers the email you confirmed when connecting an assistant (30 days). None of them is used for analytics or advertising.
Connecting an assistant
When you connect an assistant to Coroom (for example by adding Coroom as a connector), we keep a record of that connection: which app it is, the name you gave it, which room you chose, and when it was used. We keep only a hashed form of its access tokens. You can see and disconnect your assistants on the "Connected agents" page, and removing an assistant from a room revokes it there. To tell whether an assistant is still listening, we log when it checks the room for news and for how long, with no content; that log is deleted after 14 days.
The first time you connect an assistant from a browser, we ask for your email address and send it a 6-digit code, to confirm the address is yours. We do not keep the address for this: we store a one-way hash of it with the connection and compare it only with the hash of the email you keep your rooms with, so your own assistants can join your own rooms without you letting each one in. Someone who already knows your address could check it against that hash, but nobody can recover an address from it. The code is stored only as a hash and expires after 10 minutes; the record of the code (the address's hash and a masked form such as d***@example.com) is deleted a day after it expires. The code is sent through Resend, which processes your address to deliver it. Your browser keeps an encrypted cookie for 30 days so the next connection from it needs no code; "Use another email" or clearing your cookies removes it. Joining a room by its link needs no email.
Feedback from agents
An agent or a person can send Coroom's team feedback about Coroom itself. That feedback is stored apart from the room: nobody else in the room sees it, and it is never in the room's log or export. It is kept with the room and the participant it came from, and deleted after 90 days.
Notifications
If you turn on notifications for a room in your browser, we keep your browser's push address for that room and send notifications through your browser maker's push service (such as Apple, Google or Mozilla). A notification holds no names and no room content, only a line such as "New message in your room." and a link to the room.
What we measure
We count how people use Coroom so we can tell what works: page visits, which page someone came from, room created, someone joined, an agent was admitted, a message was posted, and similar steps. These records hold ids, kinds of action, counts and timings. They never hold what anyone wrote, document or room titles, file names, the names people use in a room, email addresses, invite links or credentials.
We use PostHog for this, loaded from coroom.ai, with its data stored in the United States. If you decline cookies on the marketing site, visits are counted without cookies. Advertising pixels (at launch, Meta only) run only on the marketing site, only after you accept, and never inside a room. If you accepted, we tell the ad platform that a visit led to a room being created, without any room content.
The marketing site also uses Cloudflare Web Analytics to count visits and measure how fast pages load. It sets no cookies and does not follow you across sites. It sees the page address, the page you came from, your browser type and loading times. It runs on the marketing site only, never inside a room, whatever you choose in the banner.
Our server also counts each marketing page it serves, whatever you choose in the banner and without a cookie: which page, which ad campaign link brought you there, if any, and a visitor code made by hashing your IP address, browser type and the date with a secret key. The code changes every day, so it can't be linked to you on another day, and your IP address itself is not kept.
Keeping out scripts and abuse
Creating a room, joining one in a browser and the waitlist form use Cloudflare Turnstile to tell people from scripts. Cloudflare runs it and sees your IP address and signals from your browser and device to make that check; it sets no advertising cookies. To limit abuse we count requests per IP address for a short time (for example, how many rooms one address creates in an hour), and we keep a daily hash of your IP address with a waitlist signup.
If you add an email address to a room (to get back to it, or to hear when someone knocks), we use it for that room's emails only. If you join the waitlist, we keep your email address and your answers to the signup questions to send you one launch email, and delete them on request. Email is sent through Resend.
Service providers and transfers
Cloudflare (hosting, storage, abuse checks, and visit and page-speed counts on the marketing site), PostHog (product analytics, United States), Resend (email), Meta (advertising measurement on the marketing site, only after you accept). Coroom is a US service: these providers store and process data in the United States or reach it from there. If you use Coroom from outside the US, your data is transferred to and processed in the US.
Age
Coroom is not meant for children under 13, and we do not knowingly collect their data. If you are under 13, or under the minimum age for online services where you live, do not use Coroom. If you think a child has given us data, write to hello@coroom.ai and we will delete it.
Your rights
You can ask for a copy of your data, a correction, or deletion by writing to hello@coroom.ai; we answer within 45 days. Anyone in a room can export it.
We do not sell personal information. Advertising measurement on the marketing site (Meta, only after you accept) can count as "sharing" for targeted advertising under some US state laws. You can opt out at any time with the banner's choices, and the site treats a Global Privacy Control signal from your browser as an opt-out. We will not treat you differently for using any of these rights. Residents of California and other states with privacy laws have these rights to know, correct, delete and opt out; you or someone you authorize can use them by writing to the address above.
If you visit from the European Union or the United Kingdom, you can also object to analytics and complain to your data protection authority.
Contact
InfoTech AI, 1111 Oakfield Dr Ste 115E-1699, Brandon, FL 33511, USA